Decree 314/2026/ND-CP on the operation of data exchanges

DECREE

On the operation of data exchanges^[1]

Pursuant to Law No. 63/2025/QH15 on Organisation of the Government;

Pursuant to Law No. 60/2024/QH15 on Data;

Pursuant to Law No. 91/2025/QH15 on Protection of Personal Data;

Pursuant to Law No. 20/2023/QH15 on Electronic Transactions;

Pursuant to Law No. 116/2025/QH15 on Cybersecurity;

At the proposal of the Minister of Public Security;

The Government promulgates the Decree on the operation of data exchanges.

Chapter I

GENERAL PROVISIONS

Article 1. Scope of regulation

This Decree provides the operation of data exchanges, including operations of data exchange service-providing organisations; data testing activities conducted on data exchanges; conditions for participating in transactions; conditions for data, data products, and data services to be traded on data exchanges; support for the valuation of data, data products and data services; transaction processes on data exchanges; risk management, support for handling issues arising in transactions, and support for dispute resolution; responsibilities of the seller, the buyer, and data intermediation service-providing organisations on data exchanges.

Article 2. Subjects of application

This Decree applies to agencies, organisations, enterprises, and individuals involved in activities on data exchanges.

Article 3. Interpretation of terms

1. Organisations and individuals participating in a data exchange (below referred to as participating parties) are sellers or buyers that register and use accounts on a data exchange to conduct transactions involving data, data products, and data services in accordance with this Decree.

2. Seller means an organisation or individual that trades in data, data products, and data services and grants the rights to exploit and use them on a data exchange.

3. Buyer means an organisation or individual that receives the rights to exploit and use data, data products, and data services on a data exchange.

4. Data intermediation service on a data exchange means an activity of an organisation trading in data intermediation products and services that carries out connection, negotiation support, contract conclusion for transactions, and serves the connection, transmission, access, and processing of electronic data between the seller and the buyer regarding data, data products, and data services on the data exchange without directly owning or determining the content of the traded data.

5. Data analysis and aggregation service on a data exchange means an activity of an organisation trading in data analysis and aggregation products and services that processes data to generate data products and services that have added value compared to the original data for listing and trading on the data exchange.

6. Trading account on a data exchange means an account registered by an organisation or individual on a data exchange to conduct transactions of data, data products, and data services on the data exchange.

Article 4. Operating principles of data exchanges

1. Respecting the rights to own, exploit and use data, and other lawful rights relating to data, data products and data services in activities on data exchanges; and the rights of organisations and individuals to freedom of trading, exchanging, granting rights to exploit and use data, invest, conduct business, and provide data products and services in accordance with law.

2. Ensuring fairness, publicity, and transparency in the listing and trading of data and data products, the provision of valuation support and the provision of data services on data exchanges.

3. Ensuring cybersecurity, data security, and protection of personal data and data classified as state secrets in accordance with law during transactions and storage on data exchanges.

4. Protecting the lawful rights and interests of parties participating in transactions on data exchanges.

5. Ensuring the accuracy, validity, integrity, completeness, timeliness, consistency and traceability of data, data products and data services traded on data exchanges.

6. Complying with regulations on personal data protection; and strictly prohibiting the use of data exchanges to buy and sell personal data or to process personal data in contravention of law. Data, data products and data services originating from personal data may only be traded on data exchanges when satisfying de-identification conditions and other requirements specified by the law on personal data protection.

7. Complying with regulations on intellectual property, cybersecurity, and other relevant legal provisions.

Chapter II

ORGANISATION OF THE PROVISION OF DATA EXCHANGE SERVICES

Article 5. Classification, management and operation of data exchanges

1. Data exchanges include the National Data Exchange and other data exchanges.

2. The National Data Exchange:

a/ The National Data Exchange shall be established, managed, operated, monitored, inspected and evaluated by the National Data Centre of the Ministry of Public Security; and shall perform the functions of providing data, data products, data services, and a data transaction environment in accordance with this Decree;

b/ The National Data Exchange shall provide a data transaction environment; provide data, data products and data services from the sources of the National Integrated Database, national databases, specialised databases, and other databases managed by Party agencies, state agencies and Vietnamese Fatherland Front committees, and from data provided by other organisations and individuals;

c/ The National Data Centre shall perform the functions of monitoring, inspecting, and evaluating operations of the National Data Exchange and other data exchanges.

The performance of the management, monitoring, inspection and evaluation functions must be separate from the direct operation and provision of data, data products and data services on the National Data Exchange.

The inspection and evaluation of the National Data Exchange’s satisfaction of operation conditions shall be carried out by an agency or a unit with functions independent from those of the unit directly operating the National Data Exchange, and on a regular basis or an ad hoc basis, or at the request of a competent agency;

d/ The National Data Centre shall assign its attached unit to organise the provision of national data exchange services and manage transaction data of other data exchanges connected to the National Data Exchange.

The National Data Centre must satisfy all relevant conditions on organisational structure, specialised personnel, technical infrastructure, technology system, cybersecurity, data security, personal data protection, risk management, transaction storage, monitoring and tracing, and other conditions for the operation of the National Data Exchange as specified by this Decree and other relevant regulations. National data exchange service providers are not required to carry out procedures for issuance of the certificate of eligibility for provision of data exchange services; the certificate of eligibility for provision of intermediation, data analysis and aggregation products and services; or the certificate of eligibility for provision of data analysis and aggregation products and services;

dd/ National data exchange service providers shall provide services to organisations and individuals under service provision contracts, including the following activities: data intermediation services, data analysis and aggregation services on data exchanges; bid and offering services; data, data product and data service valuation support services; data, data product and data service auction services; consultancy services for establishment, management and operation of data exchanges, and other services as specified by law;

e/ The National Data Exchange shall be organised, managed and operated in the electronic environment at the address https://sandulieuquocgia.gov.vn.

3. Other data exchanges:

a/ Data exchanges other than that specified in Clause 2 of this Article may provide data, data products and data services from the national databases and specialised databases managed by the managing authorities of those data exchange service providers, and data provided by other non-state organisations and individuals;

b/ Data exchange service providers referred to in Point a of this Clause may provide services to organisations and individuals under service provision contracts, including the following activities: bid and offering services; data, data product and data service valuation support services; and data, data product and data service auction services.

4. Data exchanges must ensure information system security at level 3 or higher. Other data exchanges must ensure data connectivity and sharing with the National Data Exchange via the data sharing and coordination platform.

The National Data Centre shall guide the data connection, interoperability and sharing, and technical assistance between the National Data Exchange and other data exchanges in order to ensure consistency and synchronism.

Article 6. Principles of determining prices and sharing revenues from data transactions on data exchanges

1. Applying prices for value-added data products and services using information from databases and information systems managed by state agencies:

a/ Value-added data products and services using information from databases and information systems managed by ministries and sectors are products and services formed on the basis of processing, analysing, aggregating or combining data to create added value compared with the original data.

Value-added data products and services using information from databases and information systems managed by ministries and sectors shall be provided at the request of organisations and individuals via data exchanges, excluding services liable to charges and fees in accordance with the law on charges and fees, and may apply the pricing mechanism in accordance with the law on prices;

b/ Ministries, ministerial-level agencies and other agencies assigned by the State to manage databases and information systems may set specific prices, maximum prices or price brackets depending on the characteristics of each type of product or service specified in Point a of this Clause, ensuring compliance with the law on prices.

2. Sellers and data intermediation service providers on data exchanges may determine and adjust by themselves the prices of data, data products and data services they provide; and may consider and apply the pricing principles, bases and methods specified by the State, and shall publicly announce and post up prices in accordance with law. Data, data products and data services on the list of goods and services subject to State pricing must comply with the law on prices.

3. Data, data products and data services owned by organisations and individuals and traded on data exchanges must comply with the civil law, the law on prices, and other relevant regulations.

4. The sharing of revenues from data, data product and data service transactions on data exchanges shall be carried out under agreements between the seller, the data intermediation service provider on the data exchange, the data exchange service provider, and related parties, based on the rights, responsibilities and level of contribution of each party, unless otherwise provided by law. For data, data products and data services formed from databases managed by state agencies or related to public assets, the division, management and use of revenue must comply with the law on the state budget, the law on management and use of public assets, and other relevant laws.

5. Ministries, ministerial-level agencies, and other agencies assigned by the State to manage databases and information systems shall formulate price plans for data, data products and data services formed from such databases and information systems and consult the Ministry of Finance before deciding on such plans according to their competence or submitting them to competent authorities and persons for decision in accordance with the law on prices.

Article 7. Data intermediation services and data analysis and aggregation services on data exchanges

1. The provision of data intermediation services on data exchanges covers the following activities:

a/ Matching the needs of sellers and buyers;

b/ Assisting parties in searching for, accessing, negotiating, concluding and performing transactions;

c/ Assisting sellers in preparing and completing dossiers of request for public notification of data, data products and data services;

d/ Inspecting, evaluating and appraising sellers’ data, data products and data services within the agreed scope of services;

dd/ Other data intermediation activities as specified by law.

2. Data intermediation service providers on data exchanges shall:

a/ Publicly announce on the data exchanges the scope, methods of service provision, and service prices (if any);

b/ Ensure independence, objectivity, honesty and transparency in service provision;

c/ Provide assistance in, and conduct inspection, evaluation and appraisal of, data, data products and data services within the agreed scope of services;

d/ Provide results of the inspection, evaluation and appraisal of data, data products and data services, clearly indicating the scope, content, implementation methods, information and documents used, and evaluation and appraisal conclusions, to sellers and data exchange service providers;

dd/ Take responsibility before law and to customers for the accuracy, truthfulness and objectivity of the inspection, evaluation and appraisal results obtained;

e/ Store and provide information and documents related to the service provision process at the request of data exchange service providers and competent authorities;

g/ Perform other obligations in accordance with law.

3. Data intermediation service providers on data exchanges may participate in data exchanges as sellers in accordance with law and shall:

a/ Fully exercise the rights and perform the obligations of sellers and publicly disclose their participation status on data exchanges;

b/ Refrain from inspecting, evaluating or appraising data, data products and data services that they themselves provide as sellers or for transactions in which they have related rights and interests.

4. Results of the inspection, evaluation and appraisal carried out by data intermediation service providers on data exchanges serve as one of the bases for data exchange service providers to consider dossiers, and do not replace the responsibilities of sellers and those of data exchange service providers to inspect and decide whether to approve or refuse listing applications.

5. In case a data intermediation service provider on a data exchange simultaneously has rights and interests related to one of the parties to a transaction, such organisation shall fully disclose its related rights and interests before providing services and refrain from taking advantage of its intermediation position, information and data to which it has access, or transaction support tools to gain an unfair competitive advantage, affect transaction results, or infringe upon lawful rights and interests of the parties.

6. Data products and services generated from data analysis and aggregation activities shall be classified and clearly announced on data exchanges as value-added data products and services, rather than raw data.

7. Organisations trading and providing data analysis and aggregation services on data exchanges shall:

a/ Disclose basic information about processing methods, input data sources, and the frequency of updates to data products and services;

b/ Ensure that the exploitation and use of input data fall within the scope of the granted rights to exploit and use such data;

c/ Ensure that data products and services do not cause confusion about the nature, origin, scope and accuracy of data;

d/ Take responsibility for the lawfulness of input data sources, processing methods, and the quality of generated data products and services;

dd/ Perform other obligations in accordance with law.

8. Data exchange service providers shall:

a/ Check the legal status and scope of operations of, and information disclosed by, sellers, buyers, data intermediation service providers on data exchanges, and data analysis and aggregation service providers;

b/ Check results of the evaluation and appraisal carried out by data intermediation service providers on data exchanges;

c/ Check and screen information relating to listings, bids, offerings and auction of data, data products and data services in order to prevent, detect and stop the use of data exchanges to buy and sell personal data or trade in personal data not yet de-identified;

d/ Suspend or terminate transactions, carry out delisting, or apply necessary technical measures upon detecting signs of violation; store relevant information and documents, and provide them to competent agencies in accordance with law.

Article 8. Bid and offering services

1. For bid services, buyers may post requests for data, data products and data services not yet available on data exchanges according to their needs. A request for data, data products and data services must clearly state the following basic information:

a/ A specific description of the requested data, data products and data services, including: name, content, period, field, scope, form and method of provision, and quality and technical requirements;

b/ Use purpose;

c/ For data and data products: requirements concerning the expected scope of rights to exploit and use data, including use duration, scope and purpose, and other conditions (if any).

2. For offering services for data and data products, data exchanges shall require sellers to provide and publicly disclose at least the following groups of information:

a/ Information on the legal status of the seller; the origin of, grounds for generating, or lawful rights to exploit and use the data and data products;

b/ A description of technical specifications, format, list of information fields, and other parameters of data and data products;

c/ Prices and scope of the licensed rights to exploit and use data and data products, including at least the following contents: use duration; licensed use purpose; territorial scope of application (if any); exclusivity or non-exclusivity of the granted rights to exploit and use data and data products; conditions and restrictions on the transfer of these rights to third parties; restrictions on intellectual property rights (if any).

3. For the offering of data intermediation services and data analysis and aggregation services on data exchanges, service providers shall publicly announce at least the following details:

a/ Scope and methods of service provision;

b/ Service prices;

c/ Certificates of eligibility to conduct business in accordance with law;

d/ Conditions and restrictions on the provision of services related to data, data products, and data services.

4. Sellers and buyers shall be responsible for the accuracy and lawfulness of bid and offering information posted on data exchanges and comply with regulations on personal data protection in the course of bidding, offering, trading in, exploiting and using data, data products and data services on data exchanges.

5. Data exchange service providers shall screen the content of bids and offerings to prevent the posting of personal data, data not yet permitted for trading, and data showing signs of violating the law on personal data protection and the law on data. For data intermediation services and data analysis and aggregation services on data exchanges, the screening covers verification of legal status, issuance of certificates of eligibility to conduct business, and verification of the completeness and validity of posted service information.

Article 9. Consultancy services for the establishment, management and operation of data exchanges

1. Consultancy services for the establishment, management and operation of data exchanges include activities of providing expert opinions, solutions, and technical and professional assistance to organisations and individuals in designing and establishing data exchanges and organising their management, operation and development in accordance with law.

2. Consultancy services include:

a/ Demand survey and analysis: Identification of the type of data, data products and data services to be traded, evaluation of use scale and users, and legal requirements;

b/ Architectural design of the information technology infrastructure system, including servers, data centres, cloud computing platforms; mechanisms for data storage, sharing, and confidentiality protection; formulation of operation processes; regulations on data transactions and data quality inspection; mechanisms for payment and data valuation;

c/ Consultancy on legal matters and data security;

d/ Training and technology transfer;

dd/ Management and operation of data exchanges.

Article 10. Services supporting valuation of data, data products and data services

1. Services supporting the valuation of data, data products and data services on data exchanges include:

a/ Market price analysis services: provision of market price information, indices, and price levels derived from the analysis and summarisation of market transaction data and technical parameters of data, data products and data services;

b/ Price appraisal connection services: acting as intermediaries to receive requests, and connect organisations and individuals seeking valuation of data, data products and data services with price appraisal enterprises eligible to provide price appraisal services under the law on prices.

2. When providing valuation support services, data exchange service providers shall:

a/ Establish, operate and regularly update the market data analysis and aggregation system to serve the provision of market price information under Point a, Clause 1 of this Article;

b/ Post up and regularly update the list of price appraisal enterprises eligible to provide price appraisal services in accordance with the law on prices on data exchange systems;

c/ Provide a confidential technical environment for price appraisal enterprises to access, examine and evaluate sample data or the technical parameters of data when requested by customers;

d/ Monitor the performance of service provision contracts between the parties, ensuring compliance with commitments and the operation regulations of data exchanges.

Article 11. Auction services for data, data products and data services

1. Data exchange service providers may organise auctions of the lawful rights to exploit and use data, data products and data services listed on data exchanges by either of the following methods:

a/ Organising auctions themselves in accordance with regulations on asset auction;

b/ Entering into service contracts with eligible asset auction-practicing organisations in accordance with regulations on asset auctions to conduct auctions using the technical infrastructure of data exchanges.

2. Data, data products and data services to be auctioned under this Article must be assets not subject to mandatory auction under law; the order and procedures for auction must comply with regulations on asset auctions. Auctions shall be held in the form of online auctions in accordance with regulations on asset auction. The applicable auction method is either the ascending-bid method or the descending-bid method depending on the characteristics of each type of auctioned data, data product, and data service.

3. Data exchange service providers or authorised asset auction-practicing organisations may issue auction regulations before the auction notice-posting date in accordance with regulations on asset auctions. In addition to the contents required by regulations on asset auctions, an auction regulation must have the following provisions:

a/ A description of data, data products and data services put up for auction, including name, format, volume, technical parameters, scope of rights to exploit and use data that are to be transferred, conditions for the transfer of exploitation rights, and associated restrictions (if any);

b/ Conditions for auction participation, and rights and obligations of related parties;

c/ Mechanism for receiving and resolving complaints and disputes arising from the auction.

4. Data exchange service providers shall establish and operate technical systems for conducting auctions that meet the following requirements:

a/ Accurately and truthfully recording the time of submission and the level of each bid, and displaying the progress of auctions in real time;

b/ Ensuring the safety and confidentiality of auction participants’ information in accordance with regulations on information safety and the operation regulation of the data exchange;

c/ Storing complete records of auction proceedings for reference, dispute resolution, and inspection by competent state management agencies;

d/ Meeting technical requirements and conditions for online auction websites in accordance with regulations on asset auction.

5. Data exchange service providers or authorised asset auction-practicing organisations shall:

a/ Verify the legal capacity and status of auction participants in accordance with regulations on asset auction;

b/ Manage advance deposits of auction participants in accordance with regulations on asset auction; refund or dispose of advance deposits based on auction results;

c/ Notify related parties of auction results; assist parties in entering into contracts to license rights to exploit and use data, data product and data service after the conclusion of the auction;

d/ Cancel auction results and handle legal consequences of the auction in accordance with regulations on asset auctions.

6. Personal data may not be put up for auction on data exchanges. Data, data products and data services originating from personal data may only be auctioned on data exchanges when they meet de-identification conditions and other requirements in accordance with regulations on personal data protection. Providers of auction services for data, data products and data services shall refuse to organise auctions for personal data, data not yet permitted for trading, or data, data products and data services showing signs of violating regulations on personal data protection.

Chapter III

TESTING ACTIVITIES ON DATA EXCHANGES

Article 12. Testing activities on data exchanges

1. Testing activities on a data exchange means the provision by the data exchange of an isolated and confidential digital environment (below referred to as the testing environment) that allows organisations and individuals wishing to buy data products and services to access, process and analyse data listed on the data exchange in order to evaluate the quality and suitability of data products and services before deciding to enter into formal transactions. Testing activities shall be conducted for a limited period and do not substitute actual transactions.

2. Purposes of testing activities on data exchanges:

a/ To enable buyers to evaluate the quality and appropriateness of data products and services before deciding on official transactions;

b/ To enable buyers to integrate data available on the data exchange with their own data within the testing environment in order to analyse and evaluate the quality and appropriateness of data products and services before conducting official transactions.

Article 13. Principles governing the operation of the testing environment

1. The testing environment shall be designed and operated in complete physical or logical isolation from the officially operated system of the data exchange and external information systems to ensure that any cybersecurity incidents or data security risks arising in the testing environment (if any) do not spread to other systems in accordance with regulations on cybersecurity.

2. Data introduced into the testing environment must comply with regulations on data and personal data protection and may only be stored and processed within the technical infrastructure of the data exchange. Testing participants may only perform data processing operations within the testing environment, and shall refrain from downloading, copying or extracting original data from the testing environment.

3. Data exchange service providers shall provide technical tools to control data flows and to prevent, detect and stop acts of unauthorised access, copying or extraction of data from the testing environment.

4. The duration of testing for a data product or service shall be determined as follows:

a/ The maximum testing duration is 30 days from the date a testing participant is granted access to the testing environment;

b/ In case a data product or service is technically complex or involves a large volume of data requiring a longer evaluation period, the data exchange service provider may permit an extension of up to 30 days at the request of the seller and the testing participant, provided that the total testing duration does not exceed 60 days;

c/ A testing participant may not register for another testing period for the same data product or service after the testing duration has expired without conducting an actual transaction, unless such data product or service has undergone significant changes in its content, version, or the scope of the granted rights to exploit and use it;

d/ Upon the expiration of the testing duration, the data exchange service provider shall automatically terminate the testing participant’s access to the testing environment and delete testing data, copies and working data within 24 hours from the time of expiration.

Article 14. Data in testing activities on data exchanges

Types of data permitted to be introduced into the testing environment include:

1. Data provided by sellers and approved for use within the scope of testing.

2. Data of testing participants.

3. Open data and shared-use data provided by data exchange service providers for testing purposes.

Article 15. Rights and obligations of parties related to testing activities on data exchanges

1. Data exchange service providers have the following rights and obligations:

a/ To ensure technical infrastructure, computing resources and analysis tools necessary for testing activities; to ensure stability, continuity and safety of the testing environment throughout the registered testing duration;

b/ To carry out cybersecurity monitoring in the testing environment in accordance with the law on cybersecurity in order to prevent, detect and promptly stop cyberattacks, unauthorised intrusions or violations of testing environment use regulations;

c/ To unilaterally terminate the testing session and delete related data in the testing environment upon detecting serious risks of cybersecurity incidents in accordance with regulations on cybersecurity, and at the same time to immediately notify such risks to competent authorities in accordance with the law on cybersecurity and to related parties;

d/ To carry out technical inspection of output results before permitting data, data products and data services to be extracted from the testing environment in order to ensure that output results do not contain sellers’ original data in any form;

dd/ To bear no liability for disputes over intellectual property rights between sellers and testing participants arising from the use of testing results, unless data exchange service providers are at fault for failing to control and prevent unauthorised data extraction.

2. Sellers have the following rights and obligations:

a/ To determine the scope of testing, types of data permitted for access, and the testing duration;

b/ To request data exchange service providers to refuse to permit the extraction of output results when there are grounds to believe that such output results contain sellers’ original data.

3. Testing participants have the following rights and obligations:

a/ To comply with testing environment use regulations and the approved testing scope;

b/ To refrain from using technical measures to misappropriate or copy sellers’ original data out of the testing environment; to refrain from committing acts that infringe upon sellers’ intellectual property rights in accordance with regulations on intellectual property;

c/ To keep information on data accessed during the testing process confidential and refrain from disclosing such information to third parties without sellers’ consent;

d/ To pay the costs of using testing infrastructure resources in accordance with regulations of data exchange service providers;

dd/ To bear legal liability for intentional violations of regulations on extraction of output results, copying or illegal use of original data; and to pay compensation for actual damage caused to data exchange service providers, sellers and related organisations and individuals in accordance with the civil law and the law on intellectual property.

4. Disputes arising during the testing process or related to testing results on data exchanges shall be resolved in accordance with the civil law, the law on intellectual property, and other relevant laws. Data exchange service providers shall keep technical operation logs of the testing environment and provide them at the request of competent authorities or disputing parties to serve as a basis for dispute resolution.

Chapter IV

CONDITIONS FOR ORGANISATIONS AND INDIVIDUALS TO PARTICIPATE IN TRANSACTIONS ON DATA EXCHANGES AND CONDITIONS FOR DATA, DATA PRODUCTS AND DATA SERVICES TO BE TRADED ON DATA EXCHANGES

Article 16. Conditions for an organisation or individual to participate in transactions on data exchanges

1. An organisation that is a Vietnamese legal entity must have been lawfully established and operating in the territory of Viet Nam; must not currently be undergoing division, separation, consolidation, merger, transformation, dissolution or bankruptcy in accordance with law.

2. An organisation that is a foreign legal entity must have been lawfully established in accordance with the law of the country where it is headquartered; must satisfy the conditions for participation in transactions specified by the civil law and other relevant regulations and must have a commercial presence, branch or representative office in Viet Nam in accordance with Viet Nam's law or treaties to which Viet Nam is a contracting party.

3. An individual must have full civil capacity in accordance with law.

4. Organisations providing data products and services on the list of conditional business lines and trades must obtain a certificate of eligibility for business in accordance with law.

Article 17. Conditions for data, data products and data services to be traded on data exchanges

Data, data products and data services to be traded on data exchanges must satisfy the following requirements:

1. Regarding the lawfulness of data and information disclosure:

a/ Having a lawful origin and being proven by valid dossiers and documents regarding the collection and creation of data or the receipt of transferred rights to exploit and use data; ensuring that the subjects, content, methods and processes used to generate data, data products and data services are transparent and compliant with law, and that such data, products and services have been inspected and evaluated by data exchange service providers.

The provision of information, dossiers and documents does not include contents constituting trade secrets or other information protected under law, unless otherwise provided by law. Data exchange service providers shall inspect and assess the compliance of dossiers and documents with this Decree;

b/ Having any conditions, requirements or restrictions (if any) in the circulation, distribution and use of data, data products and data services specified and clearly disclosed by sellers in data, data product and data service dossiers.

2. Not falling into the category of data prohibited from trading under regulations on data.

3. Satisfying the following minimum technical requirements:

a/ Having an appropriate and commonly used format, ensuring readability, exploitability and processability by machines;

b/ If provided through an application programming interface, being accompanied by documents containing connection instructions, describing the data structure, authentication methods, access authorisation and exploitation limits;

c/ Ensuring the capability to connect, share, exploit and use data on data exchange systems;

d/ Ensuring safety and security during data connection, transmission, receipt, storing and exploitation;

dd/ Ensuring that sellers disclose in listing dossiers information on the quality, accuracy, completeness and timeliness and limitations of data, data products and data services.

Data exchange service providers shall base themselves on the minimum requirements specified in this Clause to issue and publicise specific technical requirements suited to the operational characteristics of data exchanges.

Chapter V

PROCEDURES FOR TRANSACTIONS ON DATA EXCHANGES

Article 18. Registration of transaction and payment accounts on data exchanges

1. Procedures for registering transaction accounts on data exchanges shall be integrated with personal and institutional identification systems in accordance with the law on electronic identification and authentication and relevant regulations as follows:

a/ A Vietnamese citizen may register a transaction account on a data exchange via a level-2 electronic identification account on the National Identification Application (VNeID) or by another method provided on the data exchange;

b/ A Vietnamese organisation or enterprise may register a transaction account on a data exchange via a level-2 electronic identification account on VNeID or by another method provided on the data exchange;

c/ For foreign organisations or individuals:

A foreign organisation or individual that possesses a level-2 electronic identification account on VNeID may carry out the procedures applicable to Vietnamese organisations and individuals specified in Points a and b of this Clause.

If having no electronic identification account, it/he/she may carry out the verification procedures by submitting an application for opening a transaction account on the data exchange using Form DK01 provided in the Appendix to this Decree. Legal dossiers and documents must be duly certified or consularly legalised in accordance with law, unless such dossiers and documents are exempted from consular legalisation under treaties to which the Socialist Republic of Viet Nam is a contracting party or on the principle of reciprocity. Data exchange service providers shall examine and verify applications and issue transaction accounts on the data exchange according to the procedures specified in the operation regulations of the data exchange.

d/ The data exchange may use authentication methods via electronic identification systems, digital authentication platforms or electronic authentication services of competent foreign agencies or organisations, or electronic authentication systems recognised and interconnected under treaties or international agreements to which Viet Nam is a contracting party, ensuring accurate authentication of parties to transactions.

2. When registering transaction accounts on a data exchange, parties to transactions shall provide full relevant information and be responsible for the accuracy and lawfulness of such information.

3. Parties to transactions shall open payment accounts with payment service providers or use electronic wallets provided by intermediary payment service providers on the lists publicly announced by data exchange service providers on the websites of data exchanges for conducting transactions.

4. All transactions in data, data products and data services on data exchanges shall be conducted through transaction accounts and payment accounts registered on data exchanges.

5. Data, data products and data services formed from national databases and specialised databases may only be traded on data exchanges if they fully satisfy the following conditions:

a/ Falling within the scope of data permitted by law to be shared, exploited and used;

b/ Being permitted for exploitation, use and provision on data exchanges by database owners, database management agencies, or other competent entities, except for open data published in accordance with law;

c/ Not disclosing state secrets, personal data, data subject to access restrictions, or data not permitted for sharing in accordance with law;

d/ Ensuring the proper purpose, scope and methods of, and conditions for, the exploitation and use of data as permitted by competent agencies, organisations and individuals;

dd/ Being accompanied by dossiers and documents proving the rights to provide, exploit, use and trade in data, data products and data services in accordance with law.

Article 19. Registration of information on data products and services

1. A seller shall prepare a dossier of application for listing data, data products and data services, which must contain the following information:

a/ Information on the seller and the data owner or an entity having lawful rights to the data;

b/ Information on prices and payment methods;

c/ Information and documents on the origin, basis for creation, method of collection, and lawfulness of data; documents proving the seller’s status to provide data, data products and data services or license their exploitation and use on data exchanges;

d/ A description of the technical characteristics, formats, information fields and other parameters of data, data products and data services;

dd/ Scope of the granted rights to exploit and use data, including use duration; use purpose; territorial scope of application (if any); exclusivity or non-exclusivity; conditions and restrictions on subsequent transfer of rights to exploit and use data to third parties; restrictions relating to intellectual property rights (if any);

e/ Other information and documents as specified by this Decree and relevant laws.

2. For data, data products and data services formed from databases of state agencies, in addition to the information specified in Clause 1 of this Article, a dossier of application for listing must contain the following information and documents:

a/ Data-creating agency; database owner; database management agency;

b/ Agency, organisation or entity competent to decide on the provision of data, data products and data services on the data exchange;

c/ Entity responsible for the quality of data, data products and data services;

d/ Roles, rights and responsibilities of the seller and related entities;

dd/ Financial obligations and revenue distribution principles, if any;

e/ Decisions, approval documents, agreements, letters of authorisation, or other documents proving the rights to provide, exploit, use and trade in data, data products and data services on the data exchange.

3. Sellers shall:

a/ Provide complete, accurate and truthful information and documents in the dossier of application for listing;

b/ Prove the lawful origin of, and the rights to provide, exploit, use and trade in, data, data products and data services;

c/ Take responsibility before law for the accuracy, lawfulness, completeness and integrity of the dossier and the data, data products and data services requested for listing;

d/ Promptly update and supplement information and documents upon the occurrence of a change in the course of dossier examination and during the period the data, data products and data services are listed.

4. A seller may choose either of the following dossier submission methods:

a/ Sending the dossier of application for listing by hand delivery directly to the data exchange service provider. In case the dossier does not include an appraisal report, the data exchange service provider shall forward the dossier to a data intermediation service provider on the data exchange chosen by the seller for appraisal under Article 20 of this Decree;

b/ Using the services of a data intermediation service provider on the data exchange to facilitate the preparation, completion, examination, evaluation and appraisal of data products and services before submitting the dossier to the data exchange service provider. The dossier must be accompanied by inspection, evaluation and appraisal results of the data intermediation service provider on the data exchange.

5. The use of data intermediation services does not alter or exempt sellers from their responsibility for dossiers and the data, data products and data services requested for listing.

6. In case a seller is concurrently a data intermediation service provider on a data exchange, the seller may not carry out examination, evaluation or appraisal of the data products and services it provides. In this case, the seller shall use the services of another data intermediation service provider on the data exchange that has no related rights and interests.

Article 20. Examination, evaluation and appraisal of data, data products and data services

1. A data intermediation service provider chosen by a seller on a data exchange shall provide assistance and conduct examination, evaluation and appraisal within the agreed scope of services, including:

a/ Examination of the completeness and consistency of the dossier;

b/ Cross-checking of information and documents provided by the seller on the origin, and the rights to provide, exploit, use and trade in data, data products and data services;

c/ Evaluation of the seller’s satisfaction of transaction participation conditions under Article 16 of this Decree;

d/ Evaluation of the satisfaction of conditions for data, data products and data services under Article 17 of this Decree;

dd/ Evaluation of the origin, lawfulness, quality and technical requirements of data, data products and data services within the agreed scope of expertise and services;

e/ Preparation and sending of examination, evaluation and appraisal results to the seller and the data exchange service provider.

2. Data intermediation service providers on data exchanges may not carry out the examination, evaluation and appraisal specified in Clause 1 of this Article in the following cases:

a/ The data, data products and data services are provided by the data intermediation service providers themselves on data exchanges in the capacity as sellers;

b/ The data intermediation service providers have related rights and interests that may affect the independence and objectivity of examination, evaluation and appraisal results;

c/ Other cases as specified by law.

3. In case a seller directly submits a dossier not accompanied by an appraisal report, the data exchange service provider shall forward the dossier to the data intermediation service provider chosen by the seller for appraisal under Clause 1 of this Article. After receiving an appraisal report, the data exchange service provider shall examine the dossier under Clause 4 of this Article.

4. The data exchange service provider shall examine the dossier of application for listing, covering:

a/ Examining the completeness, validity and consistency of the dossier;

b/ Examining the seller’s satisfaction of transaction participation conditions under Article 16 of this Decree;

c/ Examining the satisfaction of conditions for data, data products and data services under Article 17 of this Decree;

d/ Examining information and documents specified in Article 19 of this Decree;

dd/ Reviewing the examination, evaluation and appraisal results of the data intermediation service provider on the data exchange and repeating the examination, evaluation and appraisal where necessary;

e/ Examining and determining that the data intermediation service provider on the data exchange does not fall into any of the cases specified in Clause 2 of this Article;

g/ Requiring the seller or the data intermediation service provider on the data exchange to explain and supplement information and documents where necessary.

In case clarification of the dossier is needed, the data exchange service provider may seek opinions from relevant agencies, organisations, experts and entities.

5. In case a data exchange service provider concurrently provides data intermediation services, it may carry out appraisal under Clause 1 of this Article but shall ensure separation between the appraisal unit and the listing examination and decision unit; and may not appraise the dossier and data, data products and data services it provides in the capacity as a seller or for transactions in which it has related rights and interests.

6. Based on the examination results, a data exchange service provider shall decide to:

a/ Approve the listing when the seller and data, data products and data services fully satisfy the specified conditions;

b/ Request the seller to modify or supplement the dossier when information and documents are incomplete or inconsistent, or require clarification;

c/ Request the data intermediation service provider on the data exchange to conduct further examination, evaluation and appraisal of information on data products and services when results are incomplete or inconsistent, or require clarification;

d/ Refuse listing if the seller or data, data products and data services fail to satisfy the specified conditions. The refusal shall be notified to the seller, clearly stating the reason.

7. Examination, evaluation and appraisal results of data intermediation service providers on data exchanges shall not alter the responsibility of data exchange service providers to examine dossiers of application and decide to approve or refuse listing.

Article 21. Listing of data, data products and data services

1. Data exchange service providers shall list data, data products and data services after listing has been approved under Article 20 of this Decree.

2. To-be-listed information includes:

a/ Name(s) and type(s) of data, data products and data services;

b/ Information on the seller;

c/ Information on the origin, methods of collection and creation, and the lawfulness of data, data products and data services;

d/ Technical characteristics, formats, information fields, and other parameters related to data, data products and data services;

dd/ Information on the quality, accuracy, completeness, timeliness and limitations of data, data products and data services;

e/ Prices, payment methods and scope of the granted rights to exploit and use data;

g/ Name of the data intermediation service provider on the data exchange, and the scope and results of its examination, evaluation and appraisal;

h/ Other information as specified in Article 19 of this Decree and the operation regulations of the data exchange.

3. Data exchange service providers shall ensure that the listed contents are consistent with the approved dossiers and disclose information in accordance with regulations.

Sellers shall examine information before listing it; promptly update information upon occurrence of changes, and take responsibility for the accuracy and lawfulness of updated information.

4. Data exchange service providers shall decide on suspension of listing or delisting in the following cases:

a/ Data, data products and data services are determined to have unlawful origins or have been collected or created by unlawful methods;

b/ Sellers no longer satisfy conditions for participating in transactions on data exchanges;

c/ Data, data products and data services no longer satisfy conditions specified in Article 17 of this Decree;

d/ The quality of data, data products and data services fails to conform to the disclosed quality standards or commitments and sellers fail to remedy such failure within the requested time limit;

dd/ Sellers provide inaccurate and untruthful information or fail to update changes that affect listing conditions;

e/ Under decisions or at the request of competent agencies and persons;

g/ Sellers request delisting;

h/ Other cases as specified by law and operation regulations of data exchanges.

5. Upon suspension of listing or delisting, data exchange service providers shall:

a/ Notify sellers and related parties of, and publicly disclose, the status of data, data products and data services on data exchanges;

b/ Implement necessary measures to protect lawful rights and interests of buyers that entered into transactions before the suspension of listing or delisting;

c/ Store relevant dossiers and documents to facilitate the cross-checking, search, dispute resolution, and inspection by competent state agencies;

d/ Implement other measures as specified by law and operation regulations of data exchanges.

Article 22. Initiation and establishment of transactions

1. Buyers shall be provided with detailed information and examination, evaluation and appraisal results of data products and services listed on data exchanges.

2. Forms of transaction initiation:

a/ Placing direct orders for data, data products and data services at fixed listed prices;

b/ Sending transaction offers to sellers to negotiate contractual terms and conditions in case prices or other conditions are negotiable;

c/ Auction as specified in Article 11 of this Decree.

3. Making of transaction offers; acceptance of transaction offers; modification, withdrawal, cancellation or termination of transaction offers; and determination of the time of transactions and validity of electronic contracts on data exchanges shall be carried out in accordance with the civil law, the law on electronic transactions, and lawful agreements of the parties. Data exchange service providers shall fully record and store data messages, time of sending, time of receipt, and steps to be taken by the parties to confirm transactions to facilitate cross-checking, tracing, and dispute resolution.

4. Data exchange service providers shall decide to suspend transactions for data, data products and data services in the following cases:

a/ There are signs of violations regarding the origin and lawfulness of data that are under verification;

b/ Complaints are received from buyers claiming that data quality does not meet the commitments made and verification is required;

c/ Competent state management agencies so request;

d/ There is a risk to national security or social order and safety;

dd/ Data products and services show signs of violation of regulations on data analysis and aggregation under Article 7 of this Decree.

5. Data exchange service providers shall suspend transactions as soon as possible within 24 hours from the time of detecting or receiving substantiated information on one of the cases specified in Clause 4 of this Article.

Within 5 working days from the date of transaction suspension, a data exchange service provider shall complete the review and verification process and decide to resume transactions or apply measures specified in this Decree and the operation regulations of the data exchange. In complicated cases, the verification period may be extended for no more than 5 working days, and related parties shall be notified of the extension.

6. In case of transactions on data exchanges that involve foreign organisations and individuals or give rise to cross-border data transfer and data processing activities, parties to transactions and data exchange service providers shall comply with the laws on data, personal data protection, cybersecurity, and relevant laws; apply risk management measures, and ensure national defence, security, national interests, public interests, and the lawful rights and interests of data subjects and data owners in accordance with law.

Article 23. Conclusion of contracts

1. Transactions to buy or exchange data products and services on data exchanges shall be established through electronic contracts in accordance with the law on electronic transactions. Electronic contracts may be concluded and performed through information systems of data exchanges.

2. An electronic contract must contain at least the following contents:

a/ Basic information and contact information of the seller and the buyer;

b/ Information on data products and services and appraisal information of the data intermediation service provider on the data exchange;

c/ Rights and obligations of the seller and the buyer;

d/ Quality requirements for data products and services;

dd/ Use purpose of data, data products and data services;

e/ Transaction value; payment methods, schedules and deadlines;

g/ Methods and deadlines for supply and delivery;

h/ Confidentiality obligations;

i/ Liability for contract breaches;

k/ Dispute resolution;

l/ Validity and termination of the contract.

3. An electronic contract on a data exchange becomes valid only when both parties have approved it and their approval has been demonstrated by one of the following methods, as selected by the parties according to the nature and value of the transaction: public digital signatures, specialised electronic signatures that ensure security, or other forms of electronic certification deployed by the data exchange and specified in the operation regulations of the data exchange. Other forms of certification by electronic means must satisfy at least the following conditions:

a/ Identifying the subject approving the contents of the electronic contract;

b/ Recording the time of certification;

c/ Ensuring the integrity of the contents of electronic data messages from the time of certification.

4. Data exchange service providers shall:

a/ Establish and operate technical systems that ensure proper identification of subjects and record authentication of the parties’ approval of the contents of electronic contracts in accordance with the law on electronic identification and authentication;

b/ Store electronic contracts and information on the parties’ certification while ensuring data integrity throughout the contract term and for the minimum storage period prescribed by the law on archives;

c/ Enable related parties to retrieve and search electronic contracts under regulations.

5. Modifications or supplementations to electronic contracts on data exchanges become valid only when simultaneously satisfying the following conditions:

a/ They are established in electronic contract annexes or modification or supplementation documents in the form of data messages via the data exchange’s information system;

b/ They are certified by the parties using the methods specified in Clause 3 of this Article;

c/ The data exchange’s system records and timestamps the data messages certifying the modification or supplementation. Annexes or modification or supplementation documents constitute an inseparable part of the original electronic contract.

6. Upon termination of the contract, the parties shall fulfill their liquidation obligations under the agreements set out in the electronic contracts. Data exchange service providers shall record the contract termination status on the system and ensure that transaction dossiers are stored in accordance with the law on archives.

7. Authentication of transactions and the role of data exchange service providers

a/ Data exchange service providers shall perform intermediary transaction authentication by attaching the system’s technical certifications to electronic contracts as soon as contracts become valid under this Article, including timestamps issued by timestamp trust service providers licensed in accordance with the law on electronic transactions and data message integrity assurance codes created by data exchange systems;

b/ In case the parties wish to have electronic contracts authenticated by data message authentication service providers or electronic commercial contract certification service providers, the authentication must comply with the law on electronic transactions and the law on e-commerce;

c/ Based on transaction data stored on the system, data exchange service providers shall provide transaction certification documents to the parties upon request.

Article 24. Transaction payment

1. Buyers shall fulfill their payment obligation in accordance with electronic contracts and lawful agreements between the parties. The parties may agree on full payment, partial payment, payment after delivery, or application of a mechanism for holding payment amounts in escrow until the completion of handover, examination, and certification of transaction results.

Payment transactions shall be conducted through intermediary payment service providers or payment service providers announced by data exchange service providers under Clause 3, Article 18 of this Decree and in accordance with regulations on cashless payments.

2. The official currency used for transactions is Viet Nam dong (VND).

Article 25. Delivery of data, data products and data services; recording, storage and tracing of transactions, and certification of rights to exploit and use data

1. The delivery of data, data products and data services in the form of downloadable files, granting of access via application programming interfaces (API), provision of data authentication results or other forms shall be carried out under electronic contracts and lawful agreements of the parties when the data exchange simultaneously recognises the following 2 (two) conditions:

a/ The relevant electronic contracts are valid in accordance with this Decree and other regulations;

b/ Buyers have fulfilled their payment obligations under the electronic contracts.

Buyers shall examine the results of delivery of data, data products and data services and provide feedback on them within the time limit agreed in electronic contracts. Delivery shall be deemed completed when data, data products and data services are provided in strict accordance with the descriptions, volume, scope of exploitation and use rights, and quality, technical and service-level requirements stated in the contracts; and the buyers have confirmed their acceptance or lodged no complaints.

In case data, data products and data services are delivered incompletely or incorrectly, have errors, cannot be accessed or exploited or fail to meet agreed requirements, sellers, buyers and data intermediation service providers on data exchanges shall correct errors, provide supplementary data, replace defective data, offer price reductions, issue refunds or pay compensation for damage under the contracts, within the scope of the services provided and according to each party’s degree of  fault, and in accordance with law.

2. Immediately after completing the delivery of data, data products and data services, data exchange service providers shall fully record and store transaction information in their systems, including at least the following contents:

a/ Information on sellers, buyers and data intermediation service providers on data exchanges; traded data, data products and data services, and subjects having rights to the data in accordance with law;

b/ Time of the transaction, transaction code, transaction value, form of delivery, scope of the transferred use rights or other property rights to the data;

c/ Use duration, use conditions, limits on subsequent transfers, and other related contents under electronic contracts;

d/ Timestamps, technical certifications generated by data exchange systems, and other necessary information to facilitate the cross-checking, search and verification of transactions.

3. Data exchange service providers shall establish, maintain and operate a data transaction recording, storage and tracing system satisfying the following requirements:

a/ Recording complete and accurate transaction histories for all data, data products and data services;

b/ Ensuring the integrity and verifiability of transaction records, and protecting them against unauthorised alteration and forgery;

c/ Ensuring the traceability and verifiability of transaction chains, the scope of transferred rights, and the validity status of transactions;

d/ Ensuring that information on transactions, electronic contracts, payments, handover, certification of transaction completion, access logs, processing logs, transaction codes, transaction metadata, and other necessary information are stored securely and completely, and capable of being searched, cross-checked and traced to facilitate management, inspection, examination, auditing, investigation, verification, complaint and dispute resolution, and the handling of violations.

The retention duration for information, dossiers and logs used for transaction tracing is at least 10 years from the date the transaction is completed, unless otherwise provided by law.

dd/ Ensuring connectivity and interoperability with the centralised lookup system of the National Data Exchange in accordance with this Decree.

4. Based on transaction information recorded under Clauses 2 and 3 of this Article, data exchange service providers shall issue documents certifying rights to exploit and use data in the form of data messages to buyers. Such a document must have at least the following contents:

a/ Identification information of the buyer and the seller;

b/ A description of handed-over data, data products and data services;

c/ Scope of the rights to use the transferred data and any other property rights to such data;

d/ Use duration;

dd/ Transaction code;

e/ Handover timestamp;

g/ Technical certification of the data exchange system.

5. Documents certifying the rights to exploit and use data serve as a basis for buyers to prove their receipt of lawfully transferred rights to exploit and use data, data products and data services within the use scope, for the purpose, during the period and subject to the conditions and limitations specified in electronic contracts and transaction dossiers on data exchanges.

Documents certifying the rights to exploit and use data do not certify data ownership rights, do not give rise to buyers’ data ownership rights, do not alter the rights and obligations of data owners and subjects having lawful rights to data, and do not substitute electronic contracts, electronic documents, payment information, handover information or other documents in transaction dossiers, unless otherwise provided by law.

6. National data exchange service providers shall maintain a centralised system for looking up transaction status and data use rights via the National Data Exchange, enabling parties to transactions, competent state agencies, and related organisations and individuals to look up and verify the validity of transactions, the scope of transferred rights, and the validity status of documents certifying data exploitation and use rights for data within the ambit of their respective powers and responsibilities.

7. Other data exchange service providers shall connect and interoperate transaction data and information relevant to documents certifying rights to exploit and use data as specified in Clause 4 of this Article with the National Data Exchange under the guidance of the service providers operating the National Data Exchange, ensuring that the National Data Exchange can carry out the lookup, cross-checking and verification of all transactions arising on other data exchanges.

8. The National Data Centre shall provide specific guidance on technical requirements, connection and interoperability conditions, exploitation and lookup regimes, and allocation of access rights to the data transaction recording, storage, tracing and verification systems on the National Data Exchange and between the National Data Exchange and other data exchanges.

Article 26. Evaluation of and feedback on data products and services

1. Organisations and individuals that have completed transactions on data exchanges may evaluate and provide feedback on bought data products and services, including rating, providing comments, and reporting incidents related to such data products and services.

2. Data exchange service providers shall establish and operate a system to receive, process, store and disclose information on users’ evaluations and feedback, ensuring the authenticity and integrity of evaluation information, and enabling sellers to respond to evaluations and incident reports related to their products and services.

Article 27. Prices of services provided by data exchange service providers

1. Data exchange service providers shall determine and adjust by themselves the prices of services they provide; may consider applying pricing principles, bases and methods provided by the State to determine service prices, and shall publicly announced and post up prices in accordance with law. In case data exchange services are on the list of goods and services subject to State pricing, their prices must comply with the law on prices.

2. Data exchange service providers shall determine and announce service prices, including:

a/ Prices for registering and maintaining transaction accounts on data exchanges for each category of participants;

b/ Prices for listing data products and services on data exchanges;

c/ Prices of other services provided by data exchange service providers (if any).

3. Service prices shall be publicly posted on websites of data exchanges before being applied; data exchange service providers shall promptly update them upon occurrence of any changes.

4. Service prices mentioned in this Article do not include the prices of or charges for data, data products and data services traded on data exchanges; the collection of charges and prices for data, data products and data services shall be carried out under Article 6 of this Decree.

Chapter VI

RISK MANAGEMENT, ASSISTANCE FOR HANDLING ISSUES ARISING IN TRANSACTIONS, AND ASSISTANCE FOR DISPUTE RESOLUTION

Article 28. Identification and management of risks

1. Data exchange service providers shall formulate and implement policies and procedures for identifying, assessing, providing early warnings of, and handling, risks arising in the course of management and operation of data exchanges, and during data processing; apply measures to protect the data and personal data of users and related subjects; periodically review and assess potential risks related to the management and operation of data exchanges.

2. Data exchange service providers shall establish a risk control mechanism for data products and services generated from data analysis and aggregation activities, including risks of generating misleading information, distorting data, drawing inferences, or re-identifying personal data subjects.

Article 29. Receipt and processing of requests for support and support for dispute resolution on data exchanges

1. A request for support in handling issues arising from a transaction means a request made by a party to the transaction sent to a data exchange service provider to ask for support in examining, reconciling, remedying or handling issues arising in the course of participating in, establishing, conducting and completing a transaction on a data exchange.

2. A data exchange service provider shall establish and maintain a mechanism for receiving and processing requests for support in handling issues arising in the course of listing, concluding and conducting transactions, making payments, handing over, exploiting and using data, data products and data services on the data exchange; and publicise at least one online method and other methods of receiving requests in the operation regulation of the data exchange.

3. A request for support in handling issues arising from a transaction must have the following principal contents:

a/ Information on the organisation or individual submitting the request;

b/ Codes of related data products and services;

c/ A transaction code, order code, electronic contract code or other information capable of identifying the transaction (if any);

d/ Contents of the arising issue, its causes and consequences (if any);

dd/ Contents of the request;

e/ Related documents and information (if any);

g/ Time of request submission.

4. The receipt and processing of a request for support shall be carried out as follows:

a/ Within no more than 3 working days after receiving the request with sufficient information, the data exchange service provider shall notify the requesting party of the assistance measure and the projected processing time limit;

b/ The time limit for processing the request is 15 working days from the date of receiving adequate information and documents. In complicated cases, the processing time limit may be extended once for no more than 15 working days; the extension shall be notified to the requesting party and other related parties, with the reasons for the extension clearly stated;

c/ In case the request does not have adequate information and documents, the data exchange service provider shall notify and request the requesting party to provide additional information and documents within 24 hours from the time of receipt;

d/ In case an issue arises in relation to data, data products and data services provided by the seller or data intermediary service provider on the data exchange, the data exchange service provider shall forward the request to the related entity and request its coordination in handling the issue;

dd/ In case a dispute arises between parties to a transaction, the data exchange service provider shall support the parties in reconciling information; preserve transaction dossiers; provide information, electronic documents, transaction logs and related documents recorded by the data exchange system; support the parties in the process of negotiation and mediation in accordance with the data exchange’s operation regulation when so requested; and coordinate with related agencies in providing information and documents to an arbitrator, a court or a competent agency or organisation in accordance with law;

e/ In case an arising issue is detected to show a sign of law violation, the data exchange service provider shall apply measures according to its competence or forward the information and documents to the competent agency or person for handling in accordance with law.

Article 30. Rights and obligations of the parties in the process of handling requests for support and providing support for dispute resolution

1. A support requester has the following rights and obligations:

a/ To submit a request through the related transaction account; in case the request is submitted through the requester’s representative, the representative must have a lawful basis for representation in accordance with law;

b/ To be notified of the receipt of the request, support measure, processing time limit and request processing results;

c/ To provide related information and documents in a complete, truthful and accurate manner and take responsibility before law for the provided information and documents;

d/ To coordinate with the data exchange service provider and related parties in the process of handling the request;

dd/ To exercise other rights and perform other obligations in accordance with law.

2. Responsibilities of related parties:

The seller, the buyer and parties related to the request for support shall respond, provide information and documents, and coordinate with one another in handling the request within the time limit notified by the data exchange service provider.

3. A data exchange service provider has the following rights and obligations:

a/ To request related parties to provide and add information and documents necessary for the verification and provision of assistance in handling arising issues;

b/ To refuse to process requests falling beyond the scope of operation of the data exchange and requests not backed by adequate information in order to identify the transaction after additional information has been requested, and requests with contents that violate law. The refusal shall be notified in writing to the requesting party, clearly stating the reasons;

c/ To receive and verify the request and support parties in handling arising issues under Article 29 of this Decree;

d/ To keep the confidentiality of information and documents provided by the parties, unless such information and documents are required to be provided to competent agencies, organisations or individuals in accordance with law;

dd/ To preserve dossiers of request processing in accordance with law and the data exchange’s operation regulation.

4. A data exchange service provider is not liable for damage caused in the following cases, except where it is at fault or otherwise specified by law:

a/ Damage caused by untruthful, inaccurate or inadequate information or documents provided by the requesting party or related party(ies);

b/ Damage caused by a breach of an electronic contract between the seller and the buyer that is not related to the management and operation of the data exchange.

5. A data exchange service provider is liable in accordance with law for damage caused by its fault in technical operations, operation, dossier examination, listing, payment, handover, preservation or transaction tracing activities within the scope of its management and control.

6. Principles of provision of support for dispute resolution:

a/ A data exchange service provider is not competent to issue decisions on dispute resolution for the purpose of establishing, giving rise to, changing or terminating civil rights and obligations of disputing parties, except otherwise specified by law;

b/ Disputes arising from transactions on a data exchange shall be settled through negotiation, mediation, arbitration or court or by another method as agreed upon by disputing parties in accordance with law;

c/ Pending the resolution of a dispute, the data exchange service provider shall preserve transaction dossiers, electronic documents, access logs, processing logs and information related to the disputed transaction; provide information, documents and electronic evidence to the disputing parties, arbitrator, court or competent agency or organisation in accordance with law; and apply necessary technical measures according to the data exchange’s operation regulation or at the request of the competent agency or organisation to prevent the continued illegal exploitation, use or transfer of data or to mitigate damage caused in the course of dispute resolution.

Chapter VII

RESPONSIBILITIES OF DATA EXCHANGE SERVICE PROVIDERS, SELLERS, BUYERS AND DATA INTERMEDIARY SERVICE PROVIDERS ON DATA EXCHANGES

Article 31. Responsibilities of data exchange service providers

1. Data exchange service providers shall implement the provisions of Article 35 of the Government’s Decree No. 169/2025/ND-CP of June 30, 2025, on science, technology and innovation activities and data products and services.

2. In addition to the responsibilities specified in Clause 1 of this Article, a data exchange service provider has the following responsibilities:

a/ To approve, suspend or terminate the participation of organisations and individuals on the data exchange according to the conditions specified in Article 16 of this Decree, the data exchange’s operation regulation and other relevant regulations;

b/ Upon detecting information, data, data products and data services showing signs of violating laws or the operation regulation of the data exchange, to suspend the provision of, or remove, information, data, data products and data services about, such data; the suspension or removal shall be notified to related parties in accordance with law;

c/ To regularly manage, examine and supervise cyberinformation security, data safety and data security; to prevent, stop and address data risks and supervise acts that may affect the data protection;

d/ To ensure the continuous and stable operation of the data exchange system; to formulate and maintain incident response plans and data backup and recovery plans under regulations;

dd/ To publicise and regularly update the operation regulation, listed service prices, the list of payment intermediary service providers, payment service providers and other information under regulations on the data exchange’s website;

e/ To examine dossiers and documents proving the rights to provide, exploit, use and trade in data, data products and data services derived from national databases and specialised databases before listing, offering for purchase or sale, auctioning or organising transactions on the data exchange; to refuse listing, suspend or cancel listing, stop transactions or apply necessary technical measures upon detecting that data, data products and data services fall beyond the permitted scope of sharing, exploitation or use, or show signs of law violation;

g/ In case the data exchange service provider concurrently participates as a seller on the data exchange, it shall publicise its transaction participation capacity and fully perform the responsibilities of a seller specified in Article 32 of this Decree; it shall refrain from using information, data, management tools or technical control rights to create an unfair competitive advantage, unreasonably interfere in transactions or infringe upon lawful rights and interests of parties participating in the data exchange;

h/ To perform other responsibilities in accordance with law.

Article 32. Responsibilities of sellers and buyers

1. A seller has the following responsibilities:

a/ To ensure and prove the lawful origin of, and the rights to own, provide, exploit, use, transfer and trade in, data, data products and data services; to comply with the laws on data, personal data protection, state secrets, cybersecurity, intellectual property, and other relevant laws; 

b/ To provide adequate, accurate and truthful information and documents; to ensure the quality, adequacy, timeliness and technical requirements of data, data products and data services declared, listed and provided on the data exchange;

c/ To maintain necessary technical conditions for the buyer to access, exploit and use data, data products and data services under the signed contract;

d/ To take responsibility before law and pay compensation to the buyer, the data exchange service provider or a third party for actual damage caused by the provision of inaccurate or unlawful data, data products and data services; failure to meet quality or technical requirements, or infringements of lawful rights and interests of organisations or individuals;

dd/ For data, data products and data services derived from national databases or specialised databases, to provide decisions, written approval, agreements, written authorisations or other documents proving that the seller is permitted by the competent agency, organisation or person to exploit, use and provide data and conduct data transactions on the data exchange, except for open data that have been made public in accordance with law;

e/ An agency or organisation that shares or synchronises data with the National Inegrated Database shall be regarded as a seller only when it directly provides the rights to exploit and use data on the data exchange; in case it authorises another entity/person to carry out such provision, the authorised party shall prove the lawfulness of the authorisation;

g/ To perform other responsibilities in accordance with law.

2. A buyer has the following responsibilities:

a/ To ensure that data and data products are exploited and used only within the scope, for the purposes and during the period stated in the contract, in compliance with the listing conditions applicable to data, data products and data services on the data exchange; to refrain from further transferring or reproducing such data or data products or using them beyond the agreed scope;

b/ To make full and timely payment of transaction expenses, contract value and related service charges to the data exchange service provider and the seller under regulations;

c/ To be legally responsible for the exploitation and use of data, data products and data services; and to pay compensation to the seller, the data exchange service provider, the data subject or a third party for actual damage caused by violations of the scope of the rights to exploit and use data or breaches of other contractual obligations in accordance with law;

d/ To perform other responsibilities in accordance with law.

Article 33. Responsibilities of data intermediary service providers on data exchanges

1. To perform the responsibilities specified in Article 26 of the Government’s Decree No. 169/2025/ND-CP of June 30, 2025, on science, technology and innovation activities and data products and services.

2. In addition to the responsibilities specified in Clause 1 of this Article, a data intermediary product and service provider on a data exchange shall perform the following responsibilities:

a/ To comply with law, the data exchange’s operation regulation and service provision contracts; to protect lawful rights and interests of customers, and ensure the confidentiality of customers’ data, personal data, trade secrets and other information;

b/ To provide assistance and conduct examination, evaluation and appraisal of dossiers and data, data products and data services within the agreed scope of services, in conformity with its capacities and operational conditions;

c/ To ensure independence, objectivity, accuracy and truthfulness; to take responsibility for examination, evaluation and appraisal results, and provide such results and relevant information and documents to the seller, data exchange service provider and competent authority under regulations;

d/ To refrain from examining, evaluating or appraising the dossiers, data, data products and data services it directly provides, or those involved in transactions in which it acts as the seller or has related rights or interests;

dd/ To retain dossiers, information, documents and service provision results;

e/ To perform other obligations as specified in this Decree and other relevant laws.

Chapter VIII

STATE MANAGEMENT RESPONSIBILITIES FOR OPERATIONS OF DATA EXCHANGES

Article 34. Responsibilities of the Ministry of Public Security

1. To assume the prime responsibility for formulating and promulgating according to its competence, or proposing to competent agencies for amendment, supplementation or improvement, the system of legal documents and strategies related to the development of data exchanges’ operations; to annually report to the Government on the practical operation and operation results of the National Data Exchange and other data exchanges, summarising difficulties and obstacles, and proposing solutions thereto.

2. To organise public communication about, and dissemination and law education of, operations of data exchanges.

3. To assume the prime responsibility for, and coordinate with ministries, sectors and localities in, inspecting, examining and supervising the compliance with the laws on the organisation, management and operation of, and execution of transactions on, data exchanges; to receive and settle, or forward to competent agencies or persons for settlement, complaints, denunciations, petitions and reports related to data exchanges in accordance with law; to proactively prevent, detect, stop and handle, according to its competence, violations of the laws on cybersecurity, data security and personal data protection, and other law violations arising in operations of data exchanges.

4. To direct the National Data Centre to organise the formulation, management, operation, supervision, inspection and evaluation of the National Data Exchange, ensuring resources, technical infrastructure, technological systems, cybersecurity, data security, personal data protection, and the continuous and stable operation of the National Data Exchange in accordance with this Decree and other relevant laws.

Article 35. Responsibility of the Ministry of Science and Technology

1. To coordinate with the Ministry of Public Security and related agencies in promulgating or announcing, according to its competence, a framework of minimum technical requirements for data structures, connection interfaces, identification, traceability, quality assurance, safety and interoperability among data exchanges within the ambit of its assigned functions and tasks.

2. To coordinate with the Ministry of Public Security in inspecting and supervising the compliance with quality standards and technical regulations applicable to data products and services transacted on data exchanges.

3. To handle, according to its competence, or coordinate with the Ministry of Culture, Sports and Tourism, the Ministry of Agriculture and Environment and related agencies in handling, infringements of intellectual property rights arising from transactions on data exchanges in accordance with the law on intellectual property and other relevant laws.

Article 36. Responsibilities of ministries, ministerial-level agencies and People’s Committees at all levels

1. To carry out trade promotion and attract investment in infrastructure and operations of data exchanges within the ambit of their functions, tasks and management areas.

2. To carry out public communication about, and dissemination and law education of, the rights, obligations and responsibilities of organisations and individuals under their management when participating in transactions on data exchanges.

3. To identify, within the ambit of their functions, tasks and powers, data permitted to be exploited, used or provided on data exchanges; entities competent to decide on making data available for transactions; connection methods, conditions of use, data protection responsibilities, financial obligations, and inspection and supervision mechanisms in accordance with law.

4. To coordinate with the Ministry of Public Security and related agencies in conducting inspection, examination and settlement of complaints, denunciations, petitions and reports, and handling, according to their competence, law violations committed on data exchanges falling under their respective management scopes and sectors in accordance with law.

Chapter IX

ORGANISATION OF IMPLEMENTATION

Article 37. Effect

This Decree takes effect on September 25, 2026.

Article 38. Implementation responsibility

1. The Ministry of Public Security shall guide, examine and urge the implementation of this Decree.

2. Ministers, heads of ministerial-level agencies, and chairpersons of provincial-level People’s Committees shall implement this Decree.-

On behalf of the Government
For the Prime Minister
Deputy Prime Minister
HO QUOC DUNG